More complete oidc

db/migrate/20251112114852_create_oidc_refresh_tokens.rb

@@ -0,0 +1,22 @@
+class CreateOidcRefreshTokens < ActiveRecord::Migration[8.1]
+  def change
+    create_table :oidc_refresh_tokens do |t|
+      t.string :token_digest, null: false  # BCrypt hashed token
+      t.references :application, null: false, foreign_key: true
+      t.references :user, null: false, foreign_key: true
+      t.references :oidc_access_token, null: false, foreign_key: true
+      t.string :scope
+      t.datetime :expires_at, null: false
+      t.datetime :revoked_at
+      t.integer :token_family_id  # For token rotation detection
+
+      t.timestamps
+    end
+
+    add_index :oidc_refresh_tokens, :token_digest, unique: true
+    add_index :oidc_refresh_tokens, :expires_at
+    add_index :oidc_refresh_tokens, :revoked_at
+    add_index :oidc_refresh_tokens, :token_family_id
+    add_index :oidc_refresh_tokens, [ :application_id, :user_id ]
+  end
+end